Does an audit guarantee that there is no fraud or error in the accounts?
No. An audit gives reasonable, not absolute, assurance that the accounts are free of material misstatement. It does not test every transaction and is not designed to find all fraud. Directors remain responsible for the accounts and internal controls.
What an audit does. The auditor reports whether, in their opinion, the financial statements give a true and fair view and comply with the Act and approved standards (section 266(2)). The standards describe this as reasonable assurance: a high level, but not a guarantee.
Why it cannot be a guarantee
- Auditors test samples, not every transaction.
- Fraud involving collusion, forged documents or management override can be hidden.
- Estimates and judgments (for example stock values, provisions) can be reasonably wrong.
- Errors below the materiality level are not chased.
Duties that remain with the company
- The directors must keep proper accounting records (section 245) and a system of internal control (section 246), and prepare the accounts (section 248).
- The Board approves the accounts with a director's statutory declaration (section 251).
What auditors do if they find something. They must report breaches that cannot be adequately dealt with through the audit report or the directors (section 266(8)), and report on deficiencies in records or explanations (section 266(3)).
What owners can do
- Segregate duties for banking and payments.
- Review bank reconciliations monthly.
- Check stock and fixed assets regularly.
- Ask the auditor for a management letter on control weaknesses.
An audit is a valuable check, but it is not a substitute for management oversight, and no other service replaces a required statutory audit.
Legal basis
- Companies Act 2016, ss.245, 246, 248, 251, 266
Sources
Applies to 2026 · Last reviewed 29 October 2026
General information for business owners, not legal, tax or professional advice. Rules change, so check the sources or ask a licensed professional before you act.
Related questions
- Does every Sdn Bhd in Malaysia need to be audited?Not every one, but audit is the default. Section 267(1) of the Companies Act 2016 requires a private company to appoint an auditor for each financial year, unless it qualifies for and elects the audit exemption set by SSM's Practice Directive 10/2024.
- What is audit exemption for private companies in Malaysia?Audit exemption lets an eligible private company choose not to appoint an auditor for a financial year. It rests on section 267(2) of the Companies Act 2016 and SSM Practice Directive 10/2024. The company still prepares and lodges unaudited financial statements.
- What are the audit exemption thresholds for a Sdn Bhd in 2026?For financial periods starting 1 January to 31 December 2026 (Phase 2), a private company must meet at least two of three tests: revenue up to RM2,000,000, total assets up to RM2,000,000, and no more than 20 employees. Each test covers the current and past two years.
- How do the 2025 to 2027 phases for audit exemption work?Practice Directive 10/2024 raises the audit exemption limits in three steps, based on when the financial period starts: 2025, 2026, and 2027 onwards. The final limits are RM3,000,000 revenue, RM3,000,000 total assets and 30 employees, reached for periods starting from 1 January 2027.
- How do I check if my Sdn Bhd qualifies for audit exemption?Pass at least two of three tests (revenue, total assets, employees) for the current financial year and the past two, using the limits for the phase your period falls in. Also confirm you are not an excluded company type, such as a subsidiary of a public company.